Closed Bug 578261 Opened 14 years ago Closed 14 years ago

TM: Crash [@ js_UnboxDouble(int) ] on certain page.

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
blocking2.0 --- beta5+

People

(Reporter: alice0775, Assigned: Waldo)

References

(
URL
)

Details

(Keywords: crash, regression)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100712 Firefox/4.0b2pre ID:20100712040843
Build Identifier: Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100712 Firefox/4.0b2pre ID:20100712040843

Browser crashes on certain page.

If Disable javascript.options.jit.content, the browser does not crash.

Crash reports:
bp-69869d2e-ee89-4b58-9592-07a642100712
bp-f1f51298-3675-4366-8d2c-e3b202100712

Reproducible: Always

Steps to Reproduce:
1. Start Minefield with new profile
2. Open URL ( http://mb.softbank.jp/mb/product/ )
3. Click "SoftBank 3G" at middle-left of the page
4. 

Actual Results:
 Browser crashes with crash reports

Expected Results:
 Not crash
Works:
http://hg.mozilla.org/mozilla-central/rev/38ee63fd5e34
Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100606 Minefield/3.7a5pre ID:20100606121442

Fails:
http://hg.mozilla.org/mozilla-central/rev/5b3604a3cfbe
Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100606 Minefield/3.7a5pre ID:20100606130824

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=38ee63fd5e34&tochange=5b3604a3cfbe
Thats a 119 changeset merge. If you can bisect this down a bit more that would be awesome. Thanks!
In tracemonkey build: 
sometime i get different ID [@ js::ExecuteTree ] -- Bug 571626 
bp-263268cc-7ae2-4676-892b-5dd122100712
bp-24c7f7c1-3de3-4f98-8fb3-b9e692100712

Works:
http://hg.mozilla.org/tracemonkey/rev/8f08ae0b74df
Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100604 Minefield/3.7a5pre ID:20100604043239

Fails:
http://hg.mozilla.org/tracemonkey/rev/b3e27c1ee35e
Mozilla/5.0 (Windows; U; Windows NT 6.1; WOW64; en-US; rv:1.9.3a5pre) Gecko/20100605 Minefield/3.7a5pre ID:20100605043211

Pushlog:
http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=8f08ae0b74df&tochange=b3e27c1ee35e
Keywords: crash
When I backed out b3e27c1ee35e from local build, then the browser does not crash.
So, I  guess landing of Bug 548671 causes the problem.
Blocks: 548671
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: regression
Thanks Alice!
Assignee: general → jwalden+bmo
blocking2.0: --- → ?
blocking2.0: ? → beta5+
Works For me on Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b4pre) Gecko/20100814 Minefield/4.0b4pre ID:20100814040443

Fixed range:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5aeec895393f&tochange=ddedaa587215
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ js_UnboxDouble(int) ]
You need to log in before you can comment on or make changes to this bug.